Fix macOS microphone release entitlement

[ppXD]

Summary

Add the com.apple.security.device.audio-input entitlement required by hardened-runtime macOS builds. Without it, TCC refuses to prompt for microphone permission and CoreAudio returns kAudioDevicePermissionsError (!hog), leaving live transcription unable to capture audio.

Gate the entitlement in the macOS CI build and in the release workflow. The release check mounts the final DMG and inspects the bundled app so a broken installer cannot silently pass based only on the source plist.

Test plan

• cargo test --all --all-features
• npm run check
• npm run build
• Build Wisp_0.4.0_aarch64.dmg locally with the release workflow recipe
• Verify DMG integrity with hdiutil verify
• Verify the final bundle is arm64, version 0.4.0, and passes strict code-signature validation
• Verify the final DMG contains both audio-input and library-validation entitlements
• Confirm the verifier rejects the previous v0.3.0 DMG